ThreatFox: Luca Stealer IOCs

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging the Luca Stealer malware to exfiltrate credentials, cookies, and browser data via phishing campaigns that deliver malicious attachments. Proactively hunting for these IOCs in Azure Sentinel is critical because early detection of this high-severity threat prevents lateral movement and unauthorized access resulting from compromised user identities.

IOC Summary

Malware Family: Luca Stealer Total IOCs: 3 IOC Types: md5_hash, sha1_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`2bc8a0dc10a195172f9ab72e38c4ef38c2aa1d97`	payload	2026-08-08	95%
md5_hash	`68ccd17f80bcc61bec8759b77cb80b24`	payload	2026-08-08	95%
sha256_hash	`ed71b72c1e0d19a627fea10181438779fb02bcfcd67870ce57e363a7c5168e94`	payload	2026-08-08	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Luca Stealer
let malicious_hashes = dynamic(["2bc8a0dc10a195172f9ab72e38c4ef38c2aa1d97", "68ccd17f80bcc61bec8759b77cb80b24", "ed71b72c1e0d19a627fea10181438779fb02bcfcd67870ce57e363a7c5168e94"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Luca Stealer

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Luca Stealer IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

Scenario: Automated Browser Cookie Synchronization by Endpoint Protection Agents
- Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) often perform scheduled scans that read browser cookie stores to detect credential theft. These agents may connect to internal update servers or cloud management consoles, mimicking the exfiltration behavior of Luca Stealer by accessing sensitive cookie data and sending telemetry to known C2-like IP ranges.
- Suggested Filter/Exclusion: Create a whitelist exclusion for the specific process names of the EDR agent (e.g., C:\Program Files\CrowdStrike\FalconSensor\csagent.exe or MsMpEng.exe) when connecting to internal DNS-resolved hostnames ending in .internal.corp or known Microsoft/CrowdStrike update domains.
Scenario: Scheduled IT Admin Tasks for Browser Profile Migration
- Context: During off-hours, System Administrators utilize PowerShell scripts or tools like Sysinternals PsExec to migrate user browser profiles (including cookies and history) from decommissioned workstations to new hardware or a central backup repository. This activity involves reading local browser data directories and transmitting them over the network, which can trigger the “exfiltration of sensitive data” logic of the rule.
- Suggested Filter/Exclusion: Exclude alerts where the source process is powershell.exe or psexec.exe running under a specific service account (e.g., DOMAIN\IT-Admin-Svc) and the destination IP belongs to the internal backup subnet range (e.g., 10.50.x.x).
**Scenario: Legitimate Third-Party Analytics SDKs in